Subject: Re: [ietf-dkim] A few SSP axioms

From: Scott Kitterman <[email-masked]>
Date: Mon, 31 Jul 2006 13:27 -0400

On 31 Jul 2006 15:46:41 -0000 John Levine <[email-masked]> wrote:
>>>So here's the main SSP axiom that I think should be self-evident, but 
>>>apparently isn't: other than the trivial (but useful) case of I send no 
>>>mail, the most that SSP can tell you is that a signature is missing.
>
>>I take it then that you see distinguishing between first party and third 
>>party signatures as either being of no value or not being feasible?
>
>I don't see the phrases "first party" or "third party" in there,
>either explictly or otherwise.
>
I think this is the key issue then and we ought to focus on it.  In my view 
almost the entire point of a signing policy is constraining whose 
signatures are considere authorized by the domain owner.  If we can't 
figure out how to do that, then we can't accomplish anything worth doing.  
Policies that assert all messages are signed, with no potential to 
constrain which signing domains are authorized are trivially spoofable.

I think that the pre-WG SSP draft shows the way to at least a minimally 
useful signing policy approach that makes some distinction and so I don't 
think that your assumption is correct.  DSAP is another approach that 
appears feasible.  

The challenge for the group is to determine how and if we can restrict 
authorized signing domains.  If we can't, we may as well give up on the 
whole concept.

Scott K
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John Levine <[email-masked]>
Date: 1 Aug 2006 01:22:43 -0000

>I think this is the key issue then and we ought to focus on it.  In
>my view almost the entire point of a signing policy is constraining
>whose signatures are considere authorized by the domain owner.

I'm assuming that when you say authorized, you mean authoritative.
(English definitely has its shortcomings.)

A few scenarios:

Message from domain A, signed by A; does SSP matter at all?

Message from A, signed by B; A's SSP says B signs all its mail

Message from A, signed by A and B; does SSP matter? (I hope not.)

Message from A, signed by C; SSP says nothing about C.

R's,
John

---

From: <[email-masked]>
Date: Mon, 31 Jul 2006 21:34:31 -0400

As long as we all remember that bad actors can get a domain, populate
dkim keys and ssp then send spam until they are noticed and shutdown.
Policy will be by the receiver that a message that fails dkim/ssp is
flagged for a closer examination than a message that passes both dkim
and ssp but all mail will continue to be scrutinized.
Thanks,
Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
404-847-6397 
[email-masked] 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of John Levine
Sent: Monday, July 31, 2006 9:23 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [ietf-dkim] A few SSP axioms

A few scenarios:

R's,
John

---

From: John L <[email-masked]>
Date: Mon, 31 Jul 2006 22:15:01 -0400 (EDT)

> dkim keys and ssp then send spam until they are noticed and shutdown.

I hope we all understand that if SSP is useful at all, it's only about 
authentication, not reputation.

> and ssp but all mail will continue to be scrutinized.

In the forseeable future, the main use of DKIM is likely to be more 
reliable whitelisting of people you already know you like.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://johnlevine.com, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: <[email-masked]>
Date: Mon, 31 Jul 2006 22:25:25 -0400

I am not going to recommend whitelisting ANY domain unless I own it.
Thanks,

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
404-847-6397 
[email-masked] 

-----Original Message-----
From: John L [mailto:[email-masked]] 
Sent: Monday, July 31, 2006 10:15 PM
To: Oxley, Bill (CCI-Atlanta)
Cc: DKIM List
Subject: RE: [ietf-dkim] A few SSP axioms

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for
Dummies",
Information Superhighwayman wanna-be, http://johnlevine.com, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 31 Jul 2006 23:25:19 -0400

> (English definitely has its shortcomings.)

I meant authorized, as I think the SSP concept is about authorization.  I can 
see where authoritative fits better as I wrote it.  I'm not sure there is a 
distinction between the two worth arguing about.
> Message from domain A, signed by A; does SSP matter at all?
There needs to be a design decision made.  Is it better to have a default 
policy where this case is authorized and no SSP lookup is required or is it 
better to have no assumptions made and lookup SSP in all cases.  I think this 
decision is an optimization decision that can be made late in the game.

Off the top of my head, I can't see why we would need an explicit SSP for this 
unless it is for completeness sake.  Completeness is not such a bad thing.

> Message from A, signed by B; A's SSP says B signs all its mail

I would say that A's SSP says B is an authorized signer for all its mail.  It 
may or may not be the only signer.

> Message from A, signed by A and B; does SSP matter? (I hope not.)

In my book it's the same as A signed by A.  The only concern I would have is 
if B added content, what to do about that, I'm not sure.  I expect that's 
probably a question for receiver policy and unlikely to be standardized.
> Message from A, signed by C; SSP says nothing about C.

Yes.  Then how to treat this would be a question of what A's SSP says (is the 
list exclusive or not) and the receiver policy.  

I think that the matrix that Hector did back at (or possibly just before) the 
working group started was a good one.

Scott K